An Analysis of Wireless Security at U of M Dearborn: Found Problems - PowerPoint PPT Presentation

An Analysis of Wireless Security at U of M Dearborn: Found Problems and Proposed Solutions (CASL Only)

Summary • Basic Networking Concepts • Description of vulnerabilities • Demonstration • Possible solutions

Networking Addresses 3 types of addresses • DNS address, ex. www.aol.com • IP address, ex 64.12.89.242 • MAC address, ex. 00:05:2E:8D:C7:B2

Translating Network Addresses • DNS  IP  MAC • www.aol.com  64.12.89.242  00:05:2E:8D:C7:B2

Port Explanation Port All incoming and outgoing data is 1 filtered through 2 ports in the router 3 4 … Imagine toll booth lanes on a highway …

Vulnerability #1 : Non-filtered outgoing traffic on port 53 • Should allow outgoing DNS information • Should not allow all outgoing information • Allows complete bypass of firewall by anyone

Unfiltered Port Port Attacker 51 HTTP 52 SSH 53 FTP Telnet 54 etc… 55 56

Solution • Reconfigure firewall • Only allow outgoing DNS on port 53

Vulnerability #2: Firewall only uses MAC address to determine identity • MAC addresses are publicly broadcasted • MAC addresses are easily changed, or spoofed • Spoofing = impersonating, forging, etc…

Solutions • Many appoaches • Need earlier authentication • Wireless encryption

Vulnerability #3: Client and server MAC tables changable • Reroutes traffic • Allows for more advanced attacks like recording sessions encrypted by SSH or HTTPS

ARP Poisoning Client Firewal l 141.215.4.97 141.215.4.1 MAC IP 00:2F:CD:8E:9A 141.215.4.97 ….. ….. MAC IP ….. ….. 00:2F:CD:8E:9A 141.215.4.1 ….. ….. ….. ….. Attacker

Solution • Many approaches • Need earlier authentication • Wireless encryption

Vulnerability # 4: Rogue Access Points • BYO-AP! • Tricks people into connecting to your AP • Get to client before the firewall does

Rogue Access Point Client School Router Sure, why not? Rogue Access Point “I’m the school router. Connect to my stronger signal.”

Solution • Wireless Encryption • Wireless Intrusion Detection System or WIDS

Wireless Networks • No physical security like wired networks • Accessible from far away • Multiplies dangers of vulnerabilities

High Power Antenna

Scope of Project • Only a month long • Wireless network not completely evaluated • More problems then we can present

Conclusion • A lot of changes needed • Little work to make changes • Until then, assume all traffic is being watched

Q and A